Overview

overview

10

Static

static

10

RealTek Au...er.exe

windows7-x64

10

RealTek Au...er.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RealTek Audio Mixer.exe

  • Size

    3.1MB

  • Sample

    250212-qdnvvasnfv

  • MD5

    647d21d0991b4e4dc03fa8cd7c2dd95f

  • SHA1

    e3d6496897af92bfc88e6b78668133f15211eb7b

  • SHA256

    a60bddf07efaee26d197ec7a79cfb918e05494cb061809520e6cb9b3f50563f0

  • SHA512

    72c73fedec49ecf31f0ce19b10b2172d9a06eea4868f3db911a932fd7e11b9464aacb053716ec5dfa387ed46cd952e63d5320b66940c9f9644f65dd9f639e528

  • SSDEEP

    49152:avyI22SsaNYfdPBldt698dBcjHnAw7bRvILoGdzjOTHHB72eh2NT:avf22SsaNYfdPBldt6+dBcjHnAwFm

Score
10/10
quasaroffice04discoveryspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

192.168.1.9:4782

Mutex

e0245e81-b71c-4c12-8049-2d7102b522a8

Attributes
  • encryption_key

    ADB173FE656552992028905A35B881EE584AF242

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Realtek Audio driver

  • subdirectory

    SubDir

Targets

    • Target

      RealTek Audio Mixer.exe

    • Size

      3.1MB

    • MD5

      647d21d0991b4e4dc03fa8cd7c2dd95f

    • SHA1

      e3d6496897af92bfc88e6b78668133f15211eb7b

    • SHA256

      a60bddf07efaee26d197ec7a79cfb918e05494cb061809520e6cb9b3f50563f0

    • SHA512

      72c73fedec49ecf31f0ce19b10b2172d9a06eea4868f3db911a932fd7e11b9464aacb053716ec5dfa387ed46cd952e63d5320b66940c9f9644f65dd9f639e528

    • SSDEEP

      49152:avyI22SsaNYfdPBldt698dBcjHnAw7bRvILoGdzjOTHHB72eh2NT:avf22SsaNYfdPBldt6+dBcjHnAwFm

    Score
    10/10
    quasaroffice04spywaretrojandiscovery

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks